We often need to create a {Vector} view of data owned by a container
like {std::vector}. The canonical way to do this is this:
Vector<T>{vec.data(), vec.size()}

This pattern is repeating information which can be deduced
automatically, like the type T.

This CL introduces a {VectorOf} helper which can construct a {Vector}
for any container providing a {data()} and {size()} accessor, and uses
it to replace the pattern above.

R=ishell@chromium.org

Bug: v8:8238
Change-Id: Ib3a11662acc82cb83f2b4afd07ba88e579d71dba
Reviewed-on: https://chromium-review.googlesource.com/c/1337584Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57538}

Change-Id: Id81b028629d552e2f3ebbab8bc3ab1f0e9cff3fb
Reviewed-on: https://chromium-review.googlesource.com/c/1337572Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57537}

With Bytecode flushing, the a SharedFunctionInfo's bytecode might be flushed
while the compiler is expecting it to still exist. Rather than continually
getting the bytecode from the SFI, instead bottleneck the points where we get
BytecodeArray from SFIs and maintain an explicit strong reference to the
BytecodeArray from that point onwards to prevent flushing.

BUG=v8:8395

Change-Id: I6a18adec99402838690971eb37ee0617cdc15920
Reviewed-on: https://chromium-review.googlesource.com/c/1309763
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57536}

When one of the inputs to NumberMin or NumberMax is NaN we need to
return NaN, ignoring whatever else was passed. Specifically we cannot
lower `NumberMin(x,y)` to `(x < y) ? x : y` if `x` can be NaN. So
limit this optimization to only perform the above lowering if we
know that `x` is an OrderedNumber and `y` is a PlainNumber (or if
the difference between zeros doesn't matter, an OrderedNumber as
well).

Bug: chromium:905457
Change-Id: If05f19255e14789ab0e277e072469c40e161b85b
Reviewed-on: https://chromium-review.googlesource.com/c/1337576Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57535}

The archive builder is broken since https://crrev.com/c/1330912, see:
https://ci.chromium.org/p/v8/builders/luci.v8.ci/V8%20Official%20Win64/3279

We don't need the windows cctest on the ref builds, hence this removes it.

TBR=sergiyb@chromium.org

Change-Id: Ic8d40bcc45b2f29884cc3fe9a2802e2b86f099a2
Reviewed-on: https://chromium-review.googlesource.com/c/1337583Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57534}

This adds flags for the upcoming JIT-less V8.

Build-time: v8_enable_jitless_mode in gn.args
Runtime: --jitless command-line flag

The build-time flag is expected to be removed as the implementation
matures.

Bug: v8:7777
Change-Id: Ieea404a14c7859a66e18175d1740d73182db9b1b
Reviewed-on: https://chromium-review.googlesource.com/c/1335559
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57533}

This fixes several problems with instanceof and constant field tracking
in the compiler:
- properly bailout on numbers and non-functions at @@hasInstance.
- deopt on changes of @@hasInstance property.

Bug: v8:8361
Change-Id: I4a1cf9e29d72076f2d37a7c703f18cb2fb8f4040
Reviewed-on: https://chromium-review.googlesource.com/c/1322449
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57532}

Change-Id: I0652a75f6d1f6abfb40ba9bf35afeadfd4533336
Reviewed-on: https://chromium-review.googlesource.com/c/1328801
Commit-Queue: Daniel Clifford <danno@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57531}

R=clemensh@chromium.org

Change-Id: I57183c306a4b0b38822ae3136a8c49ab94992010
Reviewed-on: https://chromium-review.googlesource.com/c/1337575Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57530}

This reverts commit bf2f0a02.

Reason for revert: https://ci.chromium.org/p/v8/builders/luci.v8.ci/V8%20Linux%20-%20nosnap%20-%20debug/21753

Original change's description:
> [builtins] Support embedded builtins in nosnapshot builds
> 
> This CL adds support for embedded builtins in nosnap builds by creating
> and setting an 'embedded blob' after builtin generation. Unlike
> snapshot builds, the blob is not embedded into the .text section but
> located on the C++ heap.
> 
> This makes nosnap builds more consistent with mksnapshot, and allows us
> to simplify there and in serializer cctests.
> 
> Complications arise from the different workflows we need to support:
> 
> 1. the standard mksnapshot build process,
> 2. nosnap builds (which reuse the blob created by the first Isolate),
> 2. and tests with various complicated serialization workflows.
> 
> To cover all of these cases, this CL introduces two knobs to twiddle:
> 
> 1. A 'sticky' embedded blob which overrides compiled-in default
>    embedded blobs at Isolate setup.
> 2. The blob lifecycle can be managed manually or through refcounting.
> 
> These are described in more detail in isolate.cc.
> 
> Tbr: ulan@chromium.org
> Bug: v8:6666, v8:8350
> Change-Id: I3842e40cdaf45d2cadd05c6eb1ec2f5e3d83568d
> Reviewed-on: https://chromium-review.googlesource.com/c/1310195
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Reviewed-by: Yang Guo <yangguo@chromium.org>
> Commit-Queue: Jakob Gruber <jgruber@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#57523}

TBR=ulan@chromium.org,yangguo@chromium.org,jgruber@chromium.org

Change-Id: I6e35a0cb7186fb50f1012f5c618fb8b48b24a813
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:6666, v8:8350
Reviewed-on: https://chromium-review.googlesource.com/c/1337577Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57529}

This reverts commit 0b13f0f5.

Reason for revert: https://ci.chromium.org/p/v8/builders/luci.v8.ci/V8%20Win32%20-%20debug/17373

Original change's description:
> [snapshot] Emit the embedded blob as assembly instead of inline assembly
> 
> The motivation behind this is that MSVC doesn't support inline assembly
> on x64. Emitting the embedded blob as a plain assembly file will give us
> MSVC support (and possibly faster compilation times as a side-effect).
> 
> Bug: v8:6666,v8:8349
> Change-Id: I2e6cf072faa9ef406fe721a05b63912c655546c2
> Reviewed-on: https://chromium-review.googlesource.com/c/1329205
> Commit-Queue: Jakob Gruber <jgruber@chromium.org>
> Reviewed-by: Michael Stanton <mvstanton@chromium.org>
> Reviewed-by: Yang Guo <yangguo@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#57524}

TBR=yangguo@chromium.org,mvstanton@chromium.org,jgruber@chromium.org

Change-Id: I35f7763f86b4de01e74827a95706b969b43af55e
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:6666, v8:8349
Reviewed-on: https://chromium-review.googlesource.com/c/1337574Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57528}

This avoids creating an on-heap copy for interpreter entry wrappers by
directly adding the {WasmCode} into the native heap instead. It reduces
compilation time as well as useless GC pressure.

R=clemensh@chromium.org
BUG=v8:8423

Change-Id: I91a8f3fc9fe542233d8700a58585f4715eed695a
Reviewed-on: https://chromium-review.googlesource.com/c/1337570Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57527}

Change-Id: Ia30702060cdcd63a3b429e05e700928a32824604
Reviewed-on: https://chromium-review.googlesource.com/c/1328944Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57526}

R=clemensh@chromium.org

Change-Id: I2ec2fdb2406efeaf3b48d0c58711db7e5172aa58
Reviewed-on: https://chromium-review.googlesource.com/c/1335699
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57525}

The motivation behind this is that MSVC doesn't support inline assembly
on x64. Emitting the embedded blob as a plain assembly file will give us
MSVC support (and possibly faster compilation times as a side-effect).

Bug: v8:6666,v8:8349
Change-Id: I2e6cf072faa9ef406fe721a05b63912c655546c2
Reviewed-on: https://chromium-review.googlesource.com/c/1329205
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57524}

This CL adds support for embedded builtins in nosnap builds by creating
and setting an 'embedded blob' after builtin generation. Unlike
snapshot builds, the blob is not embedded into the .text section but
located on the C++ heap.

This makes nosnap builds more consistent with mksnapshot, and allows us
to simplify there and in serializer cctests.

Complications arise from the different workflows we need to support:

1. the standard mksnapshot build process,
2. nosnap builds (which reuse the blob created by the first Isolate),
2. and tests with various complicated serialization workflows.

To cover all of these cases, this CL introduces two knobs to twiddle:

1. A 'sticky' embedded blob which overrides compiled-in default
   embedded blobs at Isolate setup.
2. The blob lifecycle can be managed manually or through refcounting.

These are described in more detail in isolate.cc.

Tbr: ulan@chromium.org
Bug: v8:6666, v8:8350
Change-Id: I3842e40cdaf45d2cadd05c6eb1ec2f5e3d83568d
Reviewed-on: https://chromium-review.googlesource.com/c/1310195Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57523}

R=jarin@chromium.org

Change-Id: Ia585398db7e9c69283450def924bc10edc37448f
Reviewed-on: https://chromium-review.googlesource.com/c/1335563Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Michael Stanton <mvstanton@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57522}

Add regression test to verify array with packed, holey and
dictionary elements.
Change ToUnicodeStringArray to return vector<UnicodeString>
instead allocate raw UnicodeString before calling.
Simplify ToUnicodeStringArray to loop only once.

Bug: chromium:903566
Change-Id: I7ad74179be97d3cf929d2949384dbaa8b66a9a02
Reviewed-on: https://chromium-review.googlesource.com/c/1328642
Commit-Queue: Frank Tang <ftang@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57521}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/6600235..ccf9ff5

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/6b8b30c..8a6451c

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/ef71a5f..f66e551

Rolling v8/tools/luci-go:infra/tools/luci/isolate/${platform}: https://chrome-infra-packages.appspot.com/infra/tools/luci/isolate/${platform}/+log/git_rev..git_rev

TBR=machenbach@chromium.org,hablich@chromium.org,sergiyb@chromium.org

Change-Id: Id6ee2891245ec1ce147c83ba1f9715646bb15c56
Reviewed-on: https://chromium-review.googlesource.com/c/1336783Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57520}

BUG:v8:6020

Change-Id: I289a43d834765635425276afb80c2361152fdcb0
Reviewed-on: https://chromium-review.googlesource.com/c/1336113
Commit-Queue: Deepti Gandluri <gdeepti@chromium.org>
Reviewed-by: Aseem Garg <aseemgarg@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57519}

`console.table` used to have a 1k limit on preview properties, which
regressed to 100 during refactoring.

This CL restores the 1k limit, and ensures that `buildEntryPreview`
does not use the 1k limit.

Bug: chromium:903623
Change-Id: I8fab3182a79d1bb6b662e2ff9b229db3d3a889ca
Reviewed-on: https://chromium-review.googlesource.com/c/1332127Reviewed-by: Dmitry Gozman <dgozman@chromium.org>
Commit-Queue: Erik Luo <luoe@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57518}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/8af70c5..6600235

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/0cf6ee7..6b8b30c

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/332c9ff..ef71a5f

Rolling v8/third_party/googletest/src: https://chromium.googlesource.com/external/github.com/google/googletest/+log/2e68926..879ac09

Rolling v8/tools/luci-go:infra/tools/luci/isolate/${platform}: https://chrome-infra-packages.appspot.com/infra/tools/luci/isolate/${platform}/+log/git_rev..git_rev

TBR=machenbach@chromium.org,hablich@chromium.org,sergiyb@chromium.org

Change-Id: I0cbffcb71b49e1d54e2aedb19f6dab65448586a0
Reviewed-on: https://chromium-review.googlesource.com/c/1336187Reviewed-by: Sergiy Byelozyorov <sergiyb@chromium.org>
Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: Sergiy Byelozyorov <sergiyb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57517}

Clang is known to use a lot of stack space for Debug builds, so
this patch lowers the recursion depth of that test after recent
changes made Debug-mode stack frames a bit larger.

a bit of Debug-mode stack space.

Bonus: drops an unnecessary cast from SerializeJSObject to save
Change-Id: I22696a1d80a6a73b5049b018e72cc8a3d8693042
Reviewed-on: https://chromium-review.googlesource.com/c/1334448Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57516}

This allows to call generic callables without mentioning all type
parameters, if they can be deduced from the types passed as arguments.

Bug: v8:7793
Change-Id: Idb37bb6b93c48bd6344c5be19da4e5b19d29593f
Reviewed-on: https://chromium-review.googlesource.com/c/1335936Reviewed-by: Daniel Clifford <danno@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57515}

The functions are sufficiently different and AnalyzePartially is
performance-sensitive so it's helpful to see what exact code is in there.

Change-Id: I8807684e58a7af48bdba62f0adf41e78f7b6557d
Reviewed-on: https://chromium-review.googlesource.com/c/1335701Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57514}

R=clemensh@chromium.org

Change-Id: I1b6a54b73be163386be6915402f7d8f9ba838a25
Reviewed-on: https://chromium-review.googlesource.com/c/1335697
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57513}

Change-Id: I3d07bb2d1ae8c77a6b245f5e4ca6f755e2617730
Reviewed-on: https://chromium-review.googlesource.com/c/1335698Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57512}

This avoids creating an on-heap copy for import wrappers by directly
adding the {WasmCode} into the native heap instead. It reduces
compilation time as well as useless GC pressure.

R=clemensh@chromium.org
BUG=v8:8423

Change-Id: Ia063523834c963591027c7d1ed78b795d24907bf
Reviewed-on: https://chromium-review.googlesource.com/c/1335566
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57511}

in order to be able to properly deserialize the latter in case of enabled
pointer compression where the cleared weak reference value is Isolate-dependent.

Bug: v8:7703
Change-Id: Ied995bc15317c83fcc03cf27de3fbf135659a9d5
Reviewed-on: https://chromium-review.googlesource.com/c/1333676
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57510}

This updates fast path checks in string's search/match/replace/split/matchAll
methods.

Bug: v8:8361
Change-Id: I0377aff21e380d6c718e7471f8964e10c030281b
Reviewed-on: https://chromium-review.googlesource.com/c/1333668
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57509}

Change-Id: I53fc5b8ff39c91fe509e292cf32f54ff4f8e2eb7
Reviewed-on: https://chromium-review.googlesource.com/c/1335694
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57508}

Change-Id: I9925db0d74ef96bf91ea261f275e37c10908c9ef
Reviewed-on: https://chromium-review.googlesource.com/c/1335695
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57507}

Moves the unicode predicate cache tables out of the unicode cache,
and turns them into generic predicates in char-predicates.h which
use static constexpr tables.

This drops the per-isolate cost of unicode caches, and removes the
need for accessing the unicode cache from most files. It does remove
the mutability of the cache, which means that there may be regressions
when parsing non-ASCII identifiers. Most likely the benefits to ASCII
identifiers/keywords will outweigh any non-ASCII costs.

Change-Id: I9a7a8b7c9b22d3e9ede824ab4e27f133ce20a399
Reviewed-on: https://chromium-review.googlesource.com/c/1335564Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57506}

Promise.resolve shouldn't be optimized when the async hooks are enabled.

Bug: chromium:900674
Change-Id: I225c3d9002f293395993ded37a1d475635467a94
Reviewed-on: https://chromium-review.googlesource.com/c/1335693
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57505}

Change-Id: I3331676ac226da976d7123ead81e05703272b14a
Reviewed-on: https://chromium-review.googlesource.com/c/1335929Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57504}

This makes the above factory function use a fine-grained scope when
unlocking code space for modification. It now uses a cumulative per-page
scope that collects only those memory chunks that needed to be touched
during allocation.

R=ulan@chromium.org

Change-Id: I22de0fae8be507ba9d51868f668b902b3bae3d6a
Reviewed-on: https://chromium-review.googlesource.com/c/1335558Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57503}

Variables of type {ExecutionTier} should be called "tier", not "mode".

R=ahaas@chromium.org

Bug: v8:8238
Change-Id: I09c640398ab8ad34ac6591d42ea7b0f9ba83d620
Reviewed-on: https://chromium-review.googlesource.com/c/1335688Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57502}

The callbacks must follow a specific order. This CL adds checks for
that. This helped debugging an issue in a follow-up CL.

R=ahaas@chromium.org

Bug: v8:7921
Change-Id: I78e1caf9923e95401652d2a3952dcf29c2967062
Reviewed-on: https://chromium-review.googlesource.com/c/1325965Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57501}

Also add comments and regression tests.

Bug: chromium:904272
Change-Id: I89e8ec537bbdce09fda120cd29d5a5e54e77cf19
Reviewed-on: https://chromium-review.googlesource.com/c/1335556Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57500}

Now we can pass in the prefix size to OrderedHashTable directly from
the Derived class and have it calculate the hash table start offset
based on this.

Bug: v8:6443, v8:7569
Change-Id: I80d54b65116e18f5a0cab18eb51649adad447cce
Reviewed-on: https://chromium-review.googlesource.com/c/1333682
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57499}